NetBSD Problem Report #42032
From www@NetBSD.org Thu Sep 10 02:58:10 2009
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
by www.NetBSD.org (Postfix) with ESMTP id 996BD63BC1D
for <gnats-bugs@gnats.netbsd.org>; Thu, 10 Sep 2009 02:58:10 +0000 (UTC)
Message-Id: <20090910025810.63BB663B877@www.NetBSD.org>
Date: Thu, 10 Sep 2009 02:58:10 +0000 (UTC)
From: mtbakerguy@yahoo.com
Reply-To: mtbakerguy@yahoo.com
To: gnats-bugs@NetBSD.org
Subject: libc/string/bm.c:bm_exec --> overrun
X-Send-Pr-Version: www-1.0
>Number: 42032
>Category: lib
>Synopsis: libc/string/bm.c:bm_exec --> overrun
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: lib-bug-people
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Thu Sep 10 03:00:01 +0000 2009
>Closed-Date: Mon Jun 23 10:49:07 +0000 2014
>Last-Modified: Mon Jun 23 10:49:07 +0000 2014
>Originator: B K
>Release: 5.0
>Organization:
home
>Environment:
found via code reuse
>Description:
There's a potential crash bug in the initial loop in bm_exec.c. If k is never set to zero prior to overrunning e, you'll crash as you'll keep adding pat->patlen onto s in perpetuity while eventually trying to dereference a bad pointer.
/* fast loop up to n - 3 * patlen */
e = base + n - 3 * pat->patlen;
while (s < e) {
k = d0[*s]; /* ufast skip loop */
while (k) {
k = d0[*(s += k)];
k = d0[*(s += k)];
}
I checked the OpenBSD implementation and it also has this bug.
>How-To-Repeat:
Create data where the terminal character in pattern is never found in pat->patlen's position. You should also ensure the length of the buffer is > 3*pat->patlen as you'll enter the slowpath otherwise.
>Fix:
I did a simple fixup with:
while(k && s < e)
I spent some time in the debugger and I don't believe bm_comp is the culprit as the lookup table looked fine to me.
Finally, reading the code, it seems the bm_comp/bm_free stuff could be simplified and made more reliable with a single malloc/free instead of three.
>Release-Note:
>Audit-Trail:
From: "Mateusz Kocielski" <shm@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/42032 CVS commit: src/lib/libc/string
Date: Mon, 23 Jun 2014 10:43:25 +0000
Module Name: src
Committed By: shm
Date: Mon Jun 23 10:43:25 UTC 2014
Modified Files:
src/lib/libc/string: bm.c
Log Message:
PR/42032 fixed overrun in bm_exec(), free(3) clean ups
To generate a diff of this commit:
cvs rdiff -u -r1.12 -r1.13 src/lib/libc/string/bm.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->closed
State-Changed-By: shm@NetBSD.org
State-Changed-When: Mon, 23 Jun 2014 10:49:07 +0000
State-Changed-Why:
Patch comitted.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.39 2013/11/01 18:47:49 spz Exp $
$NetBSD: gnats_config.sh,v 1.8 2006/05/07 09:23:38 tsutsui Exp $
Copyright © 1994-2007
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.